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Amendments to the Claims: 

This listing of claims will replace all prior versions, and listings, of claims in the application: 



Listing of Claims: 

1 . (Currently Amended) A method for determining whether to enforce a plurality of filter 
rules for a packet including a key in a computer network, each of the plurality of filter rules 
having a priority, the method comprising th e st e ps of : 

dividing the plurality of filter rules into at least one group based on the priority of each of 
the plurality of filter rules, each of the plurality of filter rules in each of the plurality of groups 
having a priority that is equal; 

(a) accumulating statistics for each of the plurality of filter rules, the statistics 

indicating a frequency of enforcement for each of the plurality of filter rules; and 

(b) — —placing the plurality of filter rules in an order in each group for testing against the 
key, the order being based on the frequency of each filter rule of the plurality of filter rules. 

2. Canceled. 

3. (Currently Amended) The method of claim 1 wherein the ordering step (b)-further 
includes th e st e p of : 

(hi) — providing a decision tree for testing the plurality of filter rules, the decision tree 
being configured based on the frequency of each of the plurality of filter rules and so that the 
plurality of filter rules can be tested in the order, a first portion of the plurality of filter rules 
having at least one higher priority being placed higher in the tree. 
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4. (Currently Amended) The method of claim 3 wherein the decision tree providing step 
(W^further includes the st e ps of : 

(Wi) — rebuilding the decision tree after the expiration of an interval of time. 

5. (Original) The method of claim 4 wherein the interval of time is determined based on 
a determination of how frequently a second portion of the plurality of filter rules is enforced. 

6. (Original) The method of claim 5 wherein the interval of time decreases when the first 
portion of the plurality of filter rules are accessed less frequently than a third portion of the 
plurality of filter rules. 

7. (Original) The method of claim 4 when the interval of time is determined based on a 
previous interval of time. 

8. (Currently Amended) The method of claim 4 wherein the computer network further 
includes a network processor and wherein the rebuilding st e p (bli) further includes th e st e p of : 

(bli a) placing the plurality of filter rules in the decision tree based on the priority of each 
of the plurality of filter rules and at least one performance factor of the network processor. 

9. (Currently Amended) A system for determining whether to enforce a plurality of filter 
rules for a packet including a key in a computer network, each of the plurality of filter rules 
having a priority, the system comprising: 
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at least one network processor for dividing the plurality of filter rules into a plurality of 
groups based on the priority of each of the plurality of filter rules, each of the plurality of filter 
rules in each of the plurality of groups having a priority that is equal accumulating statistics for 
each of the plurality of filter rules, the statistics indicating a frequency of enforcement for each of 
the plurality of filter rules and testing a portion of the plurality of filter rules in each group 
against the key in an order for the group , the order being based on the frequency of each filter 
rule of the portion of the plurality of filter rules; and 

at least one memory for storing the plurality of filter rules. 

10. Canceled. 

11. (Original) The system of claim 9 further comprising: 

a decision tree for testing the plurality of filter rules, the decision tree being configured 
based on the frequency of each of the plurality of filter rules and so that the network processor 
tests portion of the plurality of filter rules in the order, a first portion of the plurality of filter rules 
having at least one higher priority being placed higher in the tree. 

12. (Original) The system of claim 11 wherein the decision tree is rebuilt after the 
expiration of an interval of time. 

13. (Original) The system of claim 12 wherein the interval of time is determined based 
on a determination of how frequently a second portion of the plurality of filter rules is enforced. 
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- 14. (Original) The system of claim 13 wherein the interval of time decreases when the 
first portion of the plurality of filter rules are accessed less frequently than a third portion of the 
plurality of filter rules. 

15. (Original) The system of claim 12 when the interval of time is determined based on a 
previous interval of time. 

16. (Original) The system of claim 12 wherein the plurality of filter rules is placed in the 
decision tree based on the priority of each of the plurality of filter rules and at least one 
performance factor of the network processor. 

17. (Original) The system of claim 9 wherein the at least one memory includes a fast 
memory and wherein a first portion of the plurality of filter rules are placed in the fast memory, 
each of the first portion of the plurality of filter rules having a higher priority. 

18. (Currently Amended) A switch for use in a computer network, the switch 
determining whether to enforce a plurality of filter rules for a packet including a key, each of the 
plurality of filter rules having a priority, the switch comprising: 

at least one network processor for dividing the plurality of filter rules into a plurality of 
groups based on the priority of each of the plurality of filter rules, each of the plurality of filter 
rules in each of the plurality of groups having a priority that is equal, accumulating statistics for 
each of the plurality of filter rules, the statistics indicating a frequency of enforcement for each of 
the plurality of filter rules and testing a portion of the plurality of filter rules in each group 
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against the key in an order for the group , the order being based on the frequency of each filter 

rule of the portion of the plurality of filter rules; 

at least one memory for storing the plurality of filter rules; and 

a switch fabric coupling the plurality of proccssors at least one network processor . 

19. (Currently Amended) A computer-readable medium including a program for 
determining whether to enforce a plurality of filter rules for a packet including a key in a 
computer network, each of the plurality of filter rules having a priority, the program including 
instructions for: 

dividing the plurality of filter rules into at least one group based on the priority of each of 
the plurality of filter rules, each of the plurality of filter rules in each of the plurality of groups 
having a priority that is equal; 

(a) accumulating statistics for each of the plurality of filter rules, the statistics 

indicating a frequency of enforcement for each of the plurality of filter rules; and 

(b) placing the plurality of filter rules in an order in each group for testing against the 

key, the order being based on the frequency of each filter rule of the plurality of filter rules. 

20. Canceled. 

21. (Currently Amended) The computer-readable medium of claim 19 wherein placing 
instructions (b)-further includes instructions for: 

(bt) — providing a decision tree for testing the plurality of filter rules, the decision tree 
being configured based on the frequency of each of the plurality of filter rules and so that the 
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plurality of filter rules can be tested in the order, a first portion of the plurality of filter rules 
having at least one higher priority being placed higher in the tree. 

22. (Currently Amended) The computer-readable medium of claim 21 wherein the 
decision tree providing instructions (W^further includes instructions for: 

(W4} — rebuilding the decision tree after the expiration of an interval of time. 

23. (Original) The computer-readable medium of claim 22 wherein the interval of time 
is determined based on a determination of how frequently a second portion of the plurality of 
filter rules is enforced. 

24. (Original) The computer-readable medium of claim 23 wherein the interval of time 
decreases when the first portion of the plurality of filter rules are accessed less frequently than a 
third portion of the plurality of filter rules. 

25. (Original) The computer-readable medium of claim 22 when the interval of time is 
determined based on a previous interval of time. 

26. (Currently Amended) The computer-readable medium of claim 22 wherein the 
computer network further includes a network processor and wherein the rebuilding instructions 
(W4)-further includes instructions for: 

(bli 1) placing the plurality of filter rules in the decision tree based on the priority of each 
of the plurality of filter rules and at least one performance factor of the network processor. 

7 



Attorney Docket: RAL9200 1 00 14US 1/205 8P 

27. (Currently Amended) A method for determining whether to enforce a plurality of 
filter rules for a packet including a key in a computer network, each of the plurality of filter rules 
having a priority, the method comprising the st e ps of : 

dividing the plurality of filter rules into at least one group based on the priority of each of 
the plurality of filter rules, each of the plurality of filter rules in each of the plurality of groups 
having a priority that is equal; 

(a) accumulating statistics for each of the plurality of filter rules, the statistics 

indicating a frequency of enforcement for each of the plurality of filter rules; and 

(b) testing a portion of the plurality of filter rules in each group against the key in an 

order for that group , the order being based on the frequency of each filter rule of the portion of 
the plurality of filter rules. 
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